lokibot

General

Target

scan-223872_pdf.exe
Size

639KB
Sample

200715-x8gesy8jpn
MD5

295ac83fb3787e22a798e76d17f38d00
SHA1

30c5629df163885569ba021773e10f4d7e2c69e6
SHA256

f2b9337a8bbc0c1eb333fad67f0e28237c7af593946cc17c8cd5aca466f2b472
SHA512

442a8f8470e1980324aae03198542c2f3f0af7231748270513109da34cc53f819b810d1754ac48030a39cc4f63706fa48334260bf508fbf430250d0a70ff19ec

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://rostovafile.gq/Colba2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  scan-223872_pdf.exe
- Size
  
  639KB
- MD5
  
  295ac83fb3787e22a798e76d17f38d00
- SHA1
  
  30c5629df163885569ba021773e10f4d7e2c69e6
- SHA256
  
  f2b9337a8bbc0c1eb333fad67f0e28237c7af593946cc17c8cd5aca466f2b472
- SHA512
  
  442a8f8470e1980324aae03198542c2f3f0af7231748270513109da34cc53f819b810d1754ac48030a39cc4f63706fa48334260bf508fbf430250d0a70ff19ec
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2